Solved

exchange 2007 logs filling up at a serious rate

Posted on 2010-08-13
29
747 Views
Last Modified: 2013-11-30
Anyone any troublsshooting tips on why exchange 2007 logs are eating my disk space
i have enabled circular logging so it wont eat all my disk space
it was eating around 4gig of disk space in around half a day my database size is around 250gig
im worried that there may be a more serious issue that im not seeing
there is nothing in the event logs
what could be causing this
0
Comment
Question by:dougdog
  • 10
  • 8
  • 2
  • +6
29 Comments
 
LVL 28

Accepted Solution

by:
sunnyc7 earned 250 total points
ID: 33430453
a) Take a full backup using Veritas BackupExec and flush the logs.

Why are logs filling up > because you didnt take a backup.
When you take a full-backup logs are flushed and the logs are committed to the database. (EDB's keep a track of the log sequence). This is used for restoring the EDB's from backups, if they get corrupted.
0
 
LVL 22

Expert Comment

by:mutahir
ID: 33430491
Are you Backing up Your Exchange server with a Exchange Aware Backup Product ?

Symantec Backup Exec and Symantec Backup Exec 2010 will flush logs (if the option is selected) after a full backup.

---

With circular logging it will prevent you from doing incremental backups of the Exchange store.

Recommended is to have logging and do Full backups of Your Exchange DB.

What backup application you are using ?
0
 
LVL 22

Expert Comment

by:mutahir
ID: 33430494
Logs reflect the activity on your mailbox database - high email traffic - high number of logs.
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 250 total points
ID: 33430501
You should only ever use circular logging if you dont value your data, or where perpahs ita a replica of data sfaely stored and backed up elsewhere, is all other cases DONT USE IT.

Do a proper (FULL) backup. using windows backup or another exchnage aware backup tool, on a regular basis and the transcation logs will be truncated automatically
0
 

Author Comment

by:dougdog
ID: 33430527
commvault and taking a full backup every night but it never flushes the logs
but it is the rate at which the logs are filling the disk
i had to remove the logs manually the long names ie E00002D3F66.log
but straight after removing them in a few hours 3-4gig has been used again
surely this is not normal
0
 
LVL 70

Expert Comment

by:KCTS
ID: 33430551
What are us using to do the backup - was ikt designed for exchnage 2007 ?
NEVER manually remove logs!!!
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33430560
Commvault is the hardware.
What software are you using to take the backups to commvault.

Are you taking full backups or incremental ?
Did you set the logs to be flushed ?

here's a screenshot guide
http://www.solutions.pro/how-to-configure-backup-exec-to-purge-exchange-email-logs-123/
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33430575
a) NEVER manually remove logs.
b) CIRCULAR logging NO WAY.

It creates more problems than it solves.
0
 

Author Comment

by:dougdog
ID: 33430596
commvault is the backup software
0
 
LVL 20

Expert Comment

by:Satya Pathak
ID: 33430598
I Would suggest you take a complete Exchange Backup before doing any thing.

1. Create a New store and move all mailbox to new store One by one.
2. You can also do if you are not intersted to create a new store Just dismount the Store and Ran Eseutil /Ms command and caluculate the total white space.

3. Some time the Exchange database size automaticaly growing.

Its beter You should check white space and either you move all mailbox to new store.

Or You can should ran defrage and Isinteg.

 
0
 

Author Comment

by:dougdog
ID: 33430729
is this rate of growth normal
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33430842
4 GIG disk space in half a day > how many users do you have ?

i once had a client where a particular user X kept receiving 300 + emails from one of their clients.
Turns out on the clients outbox a message was stuck and trying to deliver.

That filled up the logs and dismounted the store.

I am trying to find a commvault guide which flushes logs, but cant seem to find one yet

This is what I have
http://documentation.commvault.com/commvault/release_8_0_0/books_online_1/english_us/deployment/deployment.htm
http://documentation.commvault.com/commvault/release_8_0_0/books_online_1/english_us/deployment/install/exchange_2000_2003.htm#Verify Summary of Install Options
0
 

Author Comment

by:dougdog
ID: 33430889
great if i could get commvault to flush the  logs
its version 7 im using
0
 
LVL 10

Expert Comment

by:dhruvarajp
ID: 33431019
grant the user that under which the commvault  runs full access on the exchange log file directory
that should flush logs after backup

did you get any altert from the app about not beeing able to delte files ?

i guess access is the issue

Thank you
dhruv
0
 

Author Comment

by:dougdog
ID: 33431060
not that i have came accross i will go through the backup alerts and check
0
 

Author Comment

by:dougdog
ID: 33431328
What exactly is contained in the logs I normally delete them  if I'm seriously stuck for space with no problems
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33431345
Are you saying you normally delete exchange logs ?
That puts your exchange in a highly unstable state > your backups will error out and it cant restore from an existing backup.

did you try a test restore from CommVault into a Recovery Storage Group and see if the database is mounting ?

All other experts also concur on this > never manually remove logs http:#33430551
0
 
LVL 10

Expert Comment

by:dhruvarajp
ID: 33431371
you can cut paste them to dirrerent directory (recomended)
what all files can be removed

look at the checkpoint

eseutil /mk against the  .chk file..

look at the waypoint if you have CCR enabled

and cut/paste  all older logs than  waypoint/checkpoint


.. you can delete logs before checkpoint/waypoint however .. may render you in problem in case you have to recover data

best way is to take a online backup.. after finshed
delete all files that are older than when backup completed


Thank you
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33431386
dhruv - any clue on commvault backup steps which flushes logs. I cant seem to find it...
0
 

Author Comment

by:dougdog
ID: 33431427
Usually moved to another locationthen deleted
Only twice when the disk completely filled up
No other choice at the time
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 33431992
First of all how many users do you have?

Circular logging has it's place and can be used as a temporary fix for these types of issue.  However it's not a permanent fix.

The chances are you have a corrupt rule, pop3 issue (if you are using pop3?) or simply a mailbox that is designated to receive all NDR messages and/or all ND emails.

Have you got limits set on your mailboxes?

Remember a transaction log is created for every type of message, in and out, external/internal,meeting requests. Etc. Etc.

As already said though, please do not manually delete the log files there is a proper procedure to follow.
0
 
LVL 2

Expert Comment

by:modru
ID: 33432255
It sounds like you either have a looping email, rejected email, or someone spamming your system. Most likely it's looping email;

Check the logs. You can also watch the Queue Viewer, see if the same emails are being sent constantly.
This could be a case of someone trying to send very large emails, or someone sending messages to an auto-reply, and then looping back. I've seen instances where someone was Out of Office, a service sent them a message, the auto-reply from OOO sent it back, and the service had an auto-reply on it, thus creating a nasty loop.
0
 

Expert Comment

by:Eskarke3
ID: 33433162
This sound like something I just went through.  This is applicable for Exchange 2003, so forgive me if it is not applicable directly to 2007.

Exchange Transaction LOG files are specific to a storage group.  If CommVault and taking a full backup every night but it never flushes the logs, you may have some corruption in your log files.

Solution 1 (if you can create a new storage group)
1. Create a new storage group AND PUT YOUR NEW DATABASES AND LOG FILES IN A NEW LOCATION.  (I'm not screaming, it's just important.)
2. Move all mailboxes to another storage group as your entire storage group is affected.  (this may also reveal corruption in mailboxes)
3. Delete the Storage group from exchange.
4. Delete log files.

Solution 2 (if you have other storage groups, but cannot create more)
1. Move all mailboxes to mail stores in other storage groups. (this may also reveal corruption in mailboxes)
2. Move the DB files and LOG files for the affected storage group to a separate location for safety sake
3. Dismount all mail stores in the storage group.
4. Delete or move the DB files and LOGs for the affected storage group.
5. Mount the storage group to re-create files.
6. Move users back (to setup for step 7)
7. Make sure circular logging is off.
8. Run another full backup and make sure that transaction logs are being cleared.

Solution 3: (Last Resort)
Do the following for one storage group at a time if more than one storage group is affected.
1. Schedule a 6 hour outage and notify users
2. Run a full backup.
3. Consider performing an exmerge WITHOUT THE ARCHIVE OPTION to capture email as a precaution.
4. Create a recovery storage group, add all of your mail stores, and TEST YOUR RESTORE!!!
5. Stop if you are not satisfied with the results.
6. Keep your recovery storage group.
7. Dismount all of your mail stores in the affected storage group.
8. Do not delete, but move your mail stores to another drive or share.
9. Mount the storage group to re-create files.
10. If all goes well, merge the content from your recovery storage groups into your new mail stores.

0
 

Expert Comment

by:Eskarke3
ID: 33433167
This sound like something I just went through.  This is applicable for Exchange 2003, so forgive me if it is not applicable directly to 2007.

Exchange Transaction LOG files are specific to a storage group.  If CommVault and taking a full backup every night but it never flushes the logs, you may have some corruption in your log files.

Solution 1 (if you can create a new storage group)
1. Create a new storage group AND PUT YOUR NEW DATABASES AND LOG FILES IN A NEW LOCATION.  (I'm not screaming, it's just important.)
2. Move all mailboxes to another storage group as your entire storage group is affected.  (this may also reveal corruption in mailboxes)
3. Delete the Storage group from exchange.
4. Delete log files.

Solution 2 (if you have other storage groups, but cannot create more)
1. Move all mailboxes to mail stores in other storage groups. (this may also reveal corruption in mailboxes)
2. Move the DB files and LOG files for the affected storage group to a separate location for safety sake
3. Dismount all mail stores in the storage group.
4. Delete or move the DB files and LOGs for the affected storage group.
5. Mount the storage group to re-create files.
6. Move users back (to setup for step 7)
7. Make sure circular logging is off.
8. Run another full backup and make sure that transaction logs are being cleared.

Solution 3: (Last Resort)
Do the following for one storage group at a time if more than one storage group is affected.
1. Schedule a 6 hour outage and notify users
2. Run a full backup.
3. Consider performing an exmerge WITHOUT THE ARCHIVE OPTION to capture email as a precaution.
4. Create a recovery storage group, add all of your mail stores, and TEST YOUR RESTORE!!!
5. Stop if you are not satisfied with the results.
6. Keep your recovery storage group.
7. Dismount all of your mail stores in the affected storage group.
8. Do not delete, but move your mail stores to another drive or share.
9. Mount the storage group to re-create files.
10. If all goes well, merge the content from your recovery storage groups into your new mail stores.

0
 

Author Comment

by:dougdog
ID: 33434119
round about 400 users
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33434136
Did you call commvault support about the logs issue ?
It may not be a looping email issue if number of users are ~400.

I'd go with figuring out how to take a full backup and test the restore, which will flush the logs.
@this point commvault is the preferred choice.
0
 

Author Comment

by:dougdog
ID: 33444036
what is the best practice in relation to storage group sizes in exchange 2007
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33446950
didnt quiet get your question @ Best Practice for Storage Group

Here's a complete guide to storage
http://msexchangeteam.com/archive/2007/01/15/432207.aspx
0
 

Author Comment

by:dougdog
ID: 33447049
just wondering if it is ok to let the mail database grow over 300gig
now that there is no limits in exchange 2007
i know from a restore point of view it would be better to have a number of smaller databases
but im just wondering if in large databases there is more chance of corruption
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Following basic email etiquette rules will help you write a professional email and achieve a good, lasting impression with your contacts.
Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question